Cloud migration in regulated finance: ambition vs. operational reality.
Every board in financial services has “move to the cloud” somewhere on its agenda. The ambition is the easy part. It’s where ambition meets operational reality that things get interesting - and, for a regulated institution, that is where the real work lives.
The pressure to act is genuine. Ageing, on-premise estates carry rising support costs and accumulating technical debt. Legacy hardware becomes harder to maintain and harder to recruit for. Regulators expect ever-stronger operational resilience. And the gap between what a modern, cloud-native business can do and what a legacy estate allows only widens with time. Standing still is not the safe option it appears to be.
But neither is rushing. A regulated lender cannot afford downtime, cannot fumble customer data, and has to be able to satisfy the PRA and FCA at every step. The ambition - cloud-first, Azure-native, SaaS where it makes sense - is simple to write into a strategy paper. Delivering it without compromising resilience, compliance or member trust is the hard bit.
We see institutions get caught at both extremes.
Some, impatient for the benefits, attempt too much too fast - a near-“big bang” migration that introduces exactly the resilience risk the regulator is most worried about. Others, mindful of the risk, become so cautious that nothing actually moves; the strategy is admired, filed, and overtaken by the very technical debt it was meant to address. Ambition without feasibility stalls. Feasibility without ambition drifts.
The route through is a phased, risk-managed roadmap built on a few firm foundations. Start with clear cloud principles and governance, agreed up front: what moves, what stays, what “good” looks like, and who holds authority over architectural decisions. Without this, every migration becomes a fresh argument and consistency is impossible.
Build resilience and compliance into the design from the start, not as an afterthought.
Operational resilience, data residency and exit planning all belong in the plan from day one - as does concentration risk, the exposure that builds when you lean too heavily on a single cloud provider. Leave any of them until after go-live and you create exactly the problems the regulator is most concerned about.
Engage the board and the regulator early. Surprises are the enemy of confidence, and a regulator taken on the journey is a very different proposition from one presented with a fait accompli. Then phase the migration to reduce disruption: incremental adoption lets an organisation build capability, prove resilience and adjust, rather than betting the estate on a single weekend.
This is the approach we’ve taken with regulated mutuals modernising tired infrastructure: a board-approved, multi-year roadmap that moves off legacy and into cloud-native services deliberately, de-risking the estate rather than gambling it. The goal is never “cloud for its own sake.” It’s resilience, agility and regulatory standing strengthened - not risked. Because that is the real reframe.
Cloud migration in regulated finance is not a technology project that happens to involve some risk.
It is a risk-managed change programme that happens to involve technology. Treat it as the former, and the regulator, sooner or later, will remind you it was always the latter.
